R-1254 (controller half): escrow claim/confirm outwait the agent (60 s); an unknown confirm outcome promises nothing

504 from the agent (it cannot learn which package the hub holds) or a failed call -> api.escrow.confirm_store_unknown
(hu+en); only 502 keeps 'your previous code still works'. Tests TestR1254_* red before the fix. Commit only.

controller/internal/agentapi/client.go

@@ -1071,6 +1071,18 @@ func (c *Client) RemoveNetStorage(ctx context.Context, name string) error {
 // status, even on a non-2xx (so callers like FormatDisk can read a 403 refusal body). A transport or
 // envelope-parse failure is still an error; an `ok:false` business refusal is NOT (the data carries it).
 func (c *Client) postWithStatus(ctx context.Context, path string, body any) (apiResponse, int, error) {
+	return c.postWithStatusOn(c.hc, ctx, path, body)
+}
+
+// postWithStatusTimeout is postWithStatus with its own overall timeout (the escrow claim and confirm, R-1254). It shares
+// the pinned transport.
+func (c *Client) postWithStatusTimeout(ctx context.Context, path string, body any, timeout time.Duration) (apiResponse, int, error) {
+	hc := *c.hc
+	hc.Timeout = timeout
+	return c.postWithStatusOn(&hc, ctx, path, body)
+}
+
+func (c *Client) postWithStatusOn(hc *http.Client, ctx context.Context, path string, body any) (apiResponse, int, error) {
 	var env apiResponse
 	buf, err := json.Marshal(body)
 	if err != nil {
@@ -1083,7 +1095,7 @@ func (c *Client) postWithStatus(ctx context.Context, path string, body any) (api
 	req.Header.Set("Authorization", "Bearer "+c.token)
 	req.Header.Set("Content-Type", "application/json")
 	start := time.Now()
-	resp, err := c.hc.Do(req)
+	resp, err := hc.Do(req)
 	if err != nil {
 		logx.Debugf(c.logger, "[agentapi] POST %s failed after %dms: %v", path, time.Since(start).Milliseconds(), err)
 		return env, 0, fmt.Errorf("agentapi: POST %s: %w", path, err)